Quantum Audit Logo

Is Synapse Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Synapse SYN
0x0f2d…9f29
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

This audit was conducted on a partial source code fragment, specifically the `AccessControlUpgradeable` contract, which is a dependency for the `SynapseERC20` token. A comprehensive security assessment of the `SynapseERC20` contract could not be performed due to the limited scope. The provided code itself is a standard OpenZeppelin implementation, generally considered robust. However, the overall security posture of the `SynapseERC20` token depends heavily on its full implementation and integration of this access control.

1 High1 Medium1 Low2 Informational
Volume 24h
$36.2K
Liquidity
$114.3K
Price
$0.09281
Token Age
4y
Top 10 Holders
68.7%

Security Findings

1 High1 Med1 Low2 Info
High

Incomplete Audit Scope Due to Partial Source Code

H-01The audit was conducted on a fragment of the project's source code, specifically the `AccessControlUpgradeable.sol` contract. The main `SynapseERC20` contract, which would integrate this access control, was not provided. This limitation prevents a comprehensive security assessment of the entire protocol, meaning potential vulnerabilities in the core logic, interactions, or other components of `SynapseERC20` could not be identified.
IssueThe audit was conducted on a fragment of the project's source code, specifically the `AccessControlUpgradeable.sol` contract. The main `SynapseERC20` contract, which would integrate this access control, was not provided. This limitation prevents a comprehensive security assessment of the entire protocol, meaning potential vulnerabilities in the core logic, interactions, or other components of `SynapseERC20` could not be identified.
FixProvide the complete source code for all relevant contracts, especially the `SynapseERC20` token and any other contracts it interacts with, to enable a full and comprehensive security audit. This will allow for a thorough analysis of architectural design, business logic, and inter-contract dependencies.
StatusUnresolved
Medium

Critical Initialization Dependency for Upgradeable Contracts

M-01The `AccessControlUpgradeable` contract, being an upgradeable component, relies on its `__AccessControl_init()` or `__AccessControl_init_unchained()` functions to be called exactly once during the inheriting contract's initialization. Failure to correctly call these initializers in the `SynapseERC20` contract's `initialize` function could lead to an uninitialized state, rendering access control mechanisms ineffective or locking critical functions.
IssueThe `AccessControlUpgradeable` contract, being an upgradeable component, relies on its `__AccessControl_init()` or `__AccessControl_init_unchained()` functions to be called exactly once during the inheriting contract's initialization. Failure to correctly call these initializers in the `SynapseERC20` contract's `initialize` function could lead to an uninitialized state, rendering access control mechanisms ineffective or locking critical functions.
FixEnsure that the `SynapseERC20` contract's `initialize` function correctly calls `__AccessControl_init()` (or `__AccessControl_init_unchained()` if part of a larger initialization chain) from its constructor or `initialize` function. Implement robust testing to verify that all upgradeable components are correctly initialized upon deployment.
StatusUnresolved
Low

Centralization Risk of DEFAULT_ADMIN_ROLE

L-01The `AccessControlUpgradeable` contract's `DEFAULT_ADMIN_ROLE` possesses the authority to grant and revoke all other roles, including itself. While this is an inherent design of the OpenZeppelin AccessControl pattern, it introduces a single point of failure. If the account(s) holding the `DEFAULT_ADMIN_ROLE` are compromised or act maliciously, the entire access control system could be subverted.
IssueThe `AccessControlUpgradeable` contract's `DEFAULT_ADMIN_ROLE` possesses the authority to grant and revoke all other roles, including itself. While this is an inherent design of the OpenZeppelin AccessControl pattern, it introduces a single point of failure. If the account(s) holding the `DEFAULT_ADMIN_ROLE` are compromised or act maliciously, the entire access control system could be subverted.
FixImplement robust security measures for the account(s) holding the `DEFAULT_ADMIN_ROLE`. This typically involves using a multi-signature wallet (e.g., Gnosis Safe) with a sufficient number of signers, or integrating it into a decentralized governance mechanism. Regularly review and audit the accounts assigned to this critical role.
StatusUnresolved
Info

Proper Use of Upgradeable Contract Pattern

I-01The contract correctly utilizes OpenZeppelin's `Initializable` base contract and includes a `__gap` storage variable. This demonstrates adherence to best practices for building upgradeable contracts, ensuring storage compatibility across different versions when used with a proxy pattern.
IssueThe contract correctly utilizes OpenZeppelin's `Initializable` base contract and includes a `__gap` storage variable. This demonstrates adherence to best practices for building upgradeable contracts, ensuring storage compatibility across different versions when used with a proxy pattern.
FixContinue to follow OpenZeppelin's upgradeability guidelines strictly for all future contract development and upgrades. Ensure that all state variables are declared before the `__gap` variable and that `initializer` modifiers are used correctly.
StatusUnresolved
Info

Leveraging OpenZeppelin Standard Library

I-02The contract extensively uses well-audited and community-vetted OpenZeppelin contracts for its access control logic. This practice significantly reduces the risk of low-level vulnerabilities and common coding errors, as these libraries are maintained and regularly updated by a reputable team.
IssueThe contract extensively uses well-audited and community-vetted OpenZeppelin contracts for its access control logic. This practice significantly reduces the risk of low-level vulnerabilities and common coding errors, as these libraries are maintained and regularly updated by a reputable team.
FixMaintain vigilance in keeping OpenZeppelin dependencies updated to their latest stable versions, especially when security patches are released. Regularly review OpenZeppelin's security advisories and release notes.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The provided code, `AccessControlUpgradeable`, is a well-vetted OpenZeppelin library, indicating a strong foundation for access control (7.2 Code Security). It utilizes standard patterns for role management, reducing the likelihood of common vulnerabilities. However, the audit scope was limited to this fragment, preventing a full assessment of the `SynapseERC20` token's core logic, including potential reentrancy, integer overflows, or other contract-specific vulnerabilities (7.1 Architecture).

GovernanceHigh1/10

The `AccessControlUpgradeable` contract provides a robust role-based access control system, allowing for granular permission management (7.3 Access Control). This structure can support decentralized governance models if properly configured. However, the `DEFAULT_ADMIN_ROLE` inherently centralizes significant power, as it can grant and revoke all other roles, including itself (7.5 Governance). The full economic model and its associated risks for the `SynapseERC20` token could not be assessed due to the limited code scope (7.4 Economic).

UpgradesHigh1/10

The contract correctly inherits from `Initializable` and includes a `__gap` variable, indicating it is designed for use in an upgradeable proxy pattern (7.7 Upgrades). This is a strong practice for future-proofing the protocol. However, proper initialization of the `AccessControlUpgradeable` contract within the inheriting `SynapseERC20` contract is critical; misconfiguration could lead to severe access control issues (7.8 Operations).

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeEtherscan Detected Custom
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

68.7% in top 10
44.2% in wallets24.4% in contracts
Effective Concentration54.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$117.0K across 6 pairs
SushiswapWETHanalysed$114.3K97.7%0xB076…Be4bFRAX$1.3K1.1%0x425a…9425WETH$5910.5%FraxswapFRAX$4880.4%BalancerWETH$2730.2%SushiswapUSDC$180.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder44.3%
Top-3 Unlocked93.5%

Key Addresses

11 addresses
Deployer
0x846e…a157
Unlocked LP Held By
0xd10e…62cf0x3887…7f1c0x9d5b…992d0x8315…043e0x08a1…4b510xb355…034d0x0cf0…4fd60x1e96…18d00x9728…8a210xe41a…2017

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

10 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Non-standard proxy storage (Etherscan-confirmed)
  • Top-10 concentration > 50% (68.7% total → 54.0% effective; 44.2% in EOAs, 24.4% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 93.5% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Synapse a scam?

The data indicates a verified contract and renounced ownership, which are positive signals for transparency and decentralization of control over the contract. However, the presence of a mint function and significant token concentration among top holders, alongside unlocked liquidity, introduces considerable risks. While these factors point to potential vulnerabilities, they do not definitively label Synapse as a scam based solely on the provided security data.

Is Synapse safe to buy?

Based on the security analysis, Synapse (SYN) presents several high-risk factors that investors should consider. The existence of a mint function, significant token concentration with the top 10 holders controlling 74.8% of supply, and critically, the absence of locked liquidity contribute to a high-risk score of 66/100. These elements suggest considerable caution is warranted due to potential for market manipulation and liquidity removal.

Has Synapse been audited?

The Synapse contract is verified on-chain, meaning its source code is publicly accessible and matches the deployed version. This allows for transparency and code inspection. While beneficial, this is distinct from a comprehensive third-party security audit, which would rigorously assess for vulnerabilities and economic risks by independent experts.

Related Audits

6 more on the record
Autonolas (OLAS)Critical RiskChipCritical RiskPortalCritical RiskNillion (NIL)Critical RisktrUSDCritical RiskMain Street USD (MSUSD)Critical Risk

Would You Like a More Detailed Audit of Synapse?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit